About marcusnilssonmr

marcusnilssonmr · ‎11-22-2016

What is the best way to have multiple threads (to use multiple cores) importing events from an amqp queue? Just duplicate the stanzas?

marcusnilssonmr · ‎11-17-2015

We have events containing amounts in different currencies that we would like to normalize into euros (for example). Is there a good app to provide exchange rates for this calculation?

marcusnilssonmr · ‎11-15-2015

Try yyyy instead of YYYY. The fomat YYYY is weakyear, which can give weird results.

marcusnilssonmr · ‎09-29-2015

Works, thx!

marcusnilssonmr · ‎09-29-2015

Latest version seems to be 0.8?

marcusnilssonmr · ‎09-25-2015

Splunk mobile access server is marked as legacy in the documentation, what is the alternative?

marcusnilssonmr · ‎09-24-2015

The Google Import app supports importing google sheets to a lookup table. Does this work on a search head cluster? Will the import run on the captain only or on all nodes? Will the lookup exist on all nodes?

marcusnilssonmr · ‎09-22-2015

I am using AMQP Messaging Modular Input to import messages from a RabbitMQ queue. When there are lots of messages in the queue and the Modular Input is started, it consumes (without ack) all messages (100k). My understanding from the settings is that it should only consume 10 at a time? How do I set a limit to cap my memory usage?

marcusnilssonmr · ‎09-10-2015

When I use earliest=-1d in Restrict search terms and search for 1 hour, I still get 1 day. So it seems it does not intersect the time range, it replaces it. Is there a way to have the time become a restriction, and not a replacement?

marcusnilssonmr · ‎08-21-2015

What capability is needed to create a new index? There is a capability for editing an index, is that used for creation as well?

marcusnilssonmr · ‎06-18-2015

I am executing a search like the following: index=x sourcetype=t | eval {Property} = Value | stats latest by ID This takes memory proportional to the amount of rows, and for all time, that means more than 10G of memory. I understand that stats needs to keep an accumulator, but I would like it to limit the amount of memory and start using disk instead, meaning a slower search, but less memory usage. Can I limit the memory usage of stats this way?

marcusnilssonmr · ‎06-15-2015

context.stanzaName is not accessible from classes outside of the package, otherwise it compiles fine.

marcusnilssonmr · ‎06-15-2015

The pluggable architecture make sense, thanks!. It would be very convenient though, if some more default handlers shipped with the plugin for some obvious choices, such as dumping as is (as you json handler above), and in a format compatible with KV_MODE=auto_escaped.

marcusnilssonmr · ‎06-10-2015

Splunk DB Connect seems to save "tail_rising_column_checkpoint_value" in inputs.conf, and it doesn't seem to be replicated in a search head cluster environment. When I look at the DB Input in the UI on each Search Head, they show different checkpoint values. Should I whitelist inputs.conf for clustering to solve this, or how is this supposed to work?

marcusnilssonmr · ‎06-08-2015

The search index=main | stats count is taking a lot of memory on the indexer when there are lots of events. Isn't the indexer doing an incremental reduce to produce the count? Why would it need a lot of memory?

Posts	20
Solutions	1
Karma Given	2
Karma Received	8
Member Since	‎02-16-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

AMQP Messaging Modular Input: What is the best way...

How to convert monetary values to a single currenc...

Splunk mobile access server marked as legacy, alte...

Google Import on Search Head Cluster

Limit unacked messages from AMQP

What capability is needed to create a new index?

Is there a way to limit memory usage of the stats ...

Splunk DB Connect 2: How to replicate "tail_rising...

Why is the memory usage high on the indexer when r...

Does multisearch suffer from subsearch limits?